Can Deleted Files Be Recovered? What Actually Happens When You Delete a File

Introduction

Most people believe that deleting a file destroys it. It does not. Deleting a file on Windows or Mac removes the file’s name from a directory listing. The actual content of the file (your photos and documents and emails and passwords) stays exactly where it was on the drive. Nothing touches the data itself during a normal delete operation.

This is not a bug or a design flaw. Operating systems work this way deliberately because it is much faster to erase a tiny directory entry than to overwrite potentially gigabytes of actual data. Speed comes at the cost of security. Every file you have ever deleted on your computer may still be sitting on the drive right now, waiting for anyone with free recovery software to bring it back.

What Actually Happens When You Delete a File

Your hard drive stores data in two separate structures. The first is the file system table (NTFS Master File Table on Windows or APFS Catalog on Mac). This table is like a book’s table of contents. It records each file’s name and its physical location on the drive and its size and permissions and timestamps. The second structure is the data area where the actual file content lives.

When you delete a file, the operating system modifies only the file system table. It marks the space occupied by that file as “available” for future use. The actual data in the data area is not touched at all. Think of it as crossing out a chapter title in the table of contents while leaving all the pages of that chapter intact inside the book. The chapter is still there. You just cannot find it through the table of contents anymore.

The operating system will eventually write new data over that space when it needs room for new files. Until that happens (which could take days or weeks or months depending on how full the drive is), the deleted data remains perfectly intact and fully recoverable.

The Recycle Bin Is Not Deletion

When you press the Delete key or right-click and choose Delete, the file moves to the Recycle Bin (Windows) or Trash (Mac). At this stage nothing is deleted at all. The file has simply been relocated to a temporary holding folder. You can restore it with a single click.

Emptying the Recycle Bin performs the actual “deletion” described above. It removes the file system entry and marks the space as available. Even after emptying the Recycle Bin, the data remains on the drive. The Recycle Bin is a convenience feature that protects against accidental deletion. It was never designed as a security mechanism.

Shift+Delete on Windows bypasses the Recycle Bin entirely and goes straight to marking the space as available. This feels more permanent but provides no additional security. The data is equally recoverable whether you emptied the Recycle Bin or used Shift+Delete.

How Data Recovery Software Finds Deleted Files

Recovery tools work by ignoring the file system table and scanning the raw data area of the drive directly. They look for recognizable patterns called file signatures (also known as magic bytes or file headers). Every file type begins with a specific byte sequence. JPEG images start with FF D8 FF. PDF documents start with 25 50 44 46 (the hex encoding of “%PDF”). ZIP archives start with 50 4B 03 04. Word documents and Excel spreadsheets (which are ZIP-based internally) also begin with 50 4B 03 04.

The recovery software scans the entire drive looking for these signatures in sectors that the file system has marked as available. When it finds a match, it reads forward from that header until it reaches the file’s end marker (or a reasonable size estimate). The result is a recovered file, often completely intact with all its original content.

This technique is called file carving and it works even after the file system has been completely reformatted. As long as the raw data sectors have not been overwritten, the files can be carved out and reassembled. Professional forensic tools like EnCase and FTK use this exact method to recover evidence from drives that suspects attempted to erase.

What Can and Cannot Be Recovered

The pattern is clear: any method that only removes file references leaves data recoverable. Any method that overwrites the actual data makes it unrecoverable. There is no middle ground. The data is either physically present on the drive or it is not.

HDD vs SSD: Recovery Works Differently

Hard disk drives (HDD): Deleted data stays on the magnetic platter until the drive writes new data to that exact physical location. On a half-empty 1 TB drive, deleted files may persist for months because the drive has plenty of unused space to write new data without touching old locations. HDD recovery rates with professional tools often exceed 90% for recently deleted files.

Solid state drives (SSD): SSDs complicate recovery because of a feature called TRIM. When you delete a file on an SSD, the operating system sends a TRIM command telling the drive that those storage cells are no longer needed. The SSD’s internal controller then clears those cells in the background to prepare them for future writes. This clearing can happen within minutes of deletion.

On a TRIM-enabled SSD (which includes virtually all modern SSDs running Windows 10/11 or macOS), recovery chances drop significantly once the TRIM command executes. However, TRIM is not instantaneous and not all cells are cleared immediately. Files deleted seconds ago may still be partially recoverable. Files deleted hours or days ago on a TRIM-enabled SSD are generally gone.

This does not mean SSDs are secure by default. TRIM is a performance optimization, not a security feature. It does not perform verified overwrites and it does not guarantee complete erasure. Sensitive data on SSDs still requires deliberate secure erasure with a tool like Univik File Eraser to ensure complete destruction.

Common Scenarios and Recovery Chances

Accidentally deleted a photo yesterday. If your drive is an HDD and you have not installed new software or saved large files since the deletion, recovery chances are very high (above 95%). On an SSD with TRIM enabled, chances depend on whether TRIM has cleared the cells. Act quickly for the best results.

Emptied the Recycle Bin last week. On an HDD, files from last week are likely still recoverable unless you have been actively downloading or installing files. The more new data written to the drive after deletion, the lower the recovery chance. On an SSD, TRIM has almost certainly cleared the cells by now.

Formatted a USB flash drive. A quick format on a USB drive only clears the file table. Recovery tools can typically restore 90-100% of the files because USB drives do not implement TRIM the way internal SSDs do.

Factory reset a laptop for sale. The standard “Just remove my files” option leaves everything recoverable. The buyer can run Recuva or PhotoRec and find your photos and documents and browsing data within minutes. This is why secure erasure before any device sale is essential.

Overwritten with secure erasure software. After a proper overwrite using Univik File Eraser (even a single pass of random data), recovery is impossible. No software-based recovery tool and no forensic lab can reconstruct the original data once it has been overwritten.

How to Delete Files So They Can Never Be Recovered

Since standard deletion only removes the file reference, permanent destruction requires overwriting the data itself. Univik File Eraser provides three approaches depending on your situation.

Wipe specific files or folders. Select the files you want to destroy permanently. The software overwrites each file’s data with the chosen erasure pattern (random data or zeros or a multi-pass standard like DoD 5220.22-M) and then removes the file entry. After this process, no recovery tool can find or reconstruct the file.

Wipe free space. This mode targets every sector on the drive that is currently marked as available. It overwrites all the “deleted but still present” data from every file you have ever deleted. Your current files and operating system remain untouched. This is the ideal approach when you want to retroactively destroy everything you have previously deleted without reinstalling Windows.

Clean system traces. Browser history and cookies and cached files and clipboard contents and recent file lists all contain personal data that standard deletion leaves behind. This mode targets these system-level data stores specifically. Run it regularly to prevent accumulation of recoverable personal information.

For maximum security, run all three: wipe specific sensitive files as you create and discard them, clean system traces periodically and wipe free space before any situation where the drive might leave your control.

Frequently Asked Questions

Can the police recover deleted files?

Law enforcement forensic labs use the same file carving techniques described above but with more powerful tools (EnCase and FTK and X-Ways). They can recover files from standard deletion and quick formatting and factory resets. They cannot recover files that have been properly overwritten with secure erasure software.

Does formatting a drive erase data permanently?

A quick format does not erase data at all. It only rebuilds the file system table. A full format on Windows 10/11 performs a single-pass zero overwrite which makes casual recovery difficult but may not satisfy forensic examination or compliance requirements. For permanent erasure, use dedicated wiping software.

How long do deleted files stay on a hard drive?

On an HDD, deleted files remain until the drive writes new data to those exact sectors. On a nearly full drive this could happen within hours. On a drive with plenty of free space, deleted files can persist for months or even years. On SSDs with TRIM, most deleted data is cleared within minutes to hours.

Is one overwrite pass enough to prevent recovery?

Yes for modern drives. NIST SP 800-88 guidelines confirm that a single overwrite pass is sufficient for both HDDs and SSDs to prevent recovery by any known method. Multi-pass overwrites (like DoD 5220.22-M with 3 passes) provide additional assurance for regulatory compliance but a single random-data pass is effective for personal use.

Can deleted files be recovered from cloud storage?

Cloud providers typically maintain deleted files in a trash folder for 30 days (Google Drive) or 93 days (OneDrive). After that retention period, the provider purges the data from their servers. However, local sync folders on your computer may still contain recoverable copies of those files on your drive.

Conclusion

Last verified: February 2026. File recovery tests performed using Recuva and PhotoRec and TestDisk on NTFS (Windows 11 24H2) and APFS (macOS Sequoia 15.3) file systems across both HDD and SSD storage. File signature scanning tested across JPEG and PDF and DOCX and XLSX and ZIP formats. TRIM behavior verified on Samsung 990 Pro NVMe and Crucial MX500 SATA SSDs.

Deletion is not destruction. Every file you delete through normal means (Recycle Bin or Shift+Delete or quick format or factory reset) remains on the drive in a recoverable state until something else overwrites it. Free recovery tools make finding these files trivial. The only way to ensure a deleted file cannot be recovered is to overwrite its physical storage location with new data. Univik File Eraser does exactly this using verified erasure standards that make recovery impossible by any method.